BlueCats Reveal Android App Insecure Storage

published 2019-05-22 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-15201

cvss: 2.8; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 28%
public exploits: 0; none known

The Android mobile application BlueCats Reveal before 3.0.19 stores the username and password in a clear text file. This file persists until the user logs out or the session times out from non-usage (30 days of no user activity). This can allow an attacker to compromise the affected BlueCats network implementation. The attacker would first need to gain physical control of the Android device or compromise it with a malicious app.

Patch / fix

fixed in 1

bluecats bluecats_reveal 3.0.19

Exploit prediction

0.35% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

blog.rapid7.com https://blog.rapid7.com/2019/05/21/investigating-the-plumbing-of-the-iot-ecosystem-r7-2018-65-r7-2019-07-fixed/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.0	2.8	CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
NVD	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	2.1	AV:L/AC:L/Au:N/C:P/I:N/A:N

Affected products

BlueCats Reveal

Classification

Weakness

CWE-922 Insecure Storage of Sensitive Information
CWE-522 Insufficiently Protected Credentials

References

blog.rapid7.com /2019/05/21/investigating-the-plumbing-of-the-iot-ecosystem-r7-2018-65-r7-2019-07-fixed/
exploit, third-party-advisory
play.google.com /store/apps/details?id=com.bluecats.bcreveal
product

Sources

CVE List CVE-2019-5626
NVD CVE-2019-5626

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary